Performance aggregation. The well-established GLUE-style benchmarks evaluate systems using mean aggregation over heterogeneous task-specific metrics [1]}, [2]}, [3]}. Based on the criticism of this evaluation protocol by the research community [4]}, [5]}, [6]}, we recognize that mean aggregation in our case does not account for the nature of the adversarial transformations and attacks and task specifications, such as the task type, domain, and the number of episodes in \(\mathcal {D}_{train}\)  and \(\mathcal {D}_{test}\) .
